Cyber Security Research Institute Report Into the Internet of Things

PINNING DOWN THE IOT Cyber Security Research Institute report into the Internet of Things Sponsored by F-Secure CONTENTS Executive Summary .............................................................................................................................. 3 Introduction ........................................................................................................................................... 5 The pervasiveness of the new Internet of Things .............................................................................. 7 The Connected Home .......................................................................................................................... 9 The consumer reaction ....................................................................................................................... 14 Coping with an ageing population ....................................................................................................................... 14 IoMe and the IOWT: The Internet of Me and the Internet of Women Things .............................. 16 The overwhelming case for regulation .............................................................................................. 18 The regulator’s digital knowledge gap ............................................................................................... 20 The push for regulation ...................................................................................................................... 20 Summary ................................................................................................................................................ 21 Culture ...................................................................................................................................................................... 21 Taking back control ................................................................................................................................................. 21 Appropriate use ....................................................................................................................................................... 22 Education ................................................................................................................................................................ 22 Responsibility .......................................................................................................................................................... 23 PINNING DOWN THE IOT 2 EXECUTIVE SUMMARY In its current form the Internet of Things (IoT) represents Zigbee and Z-Wave and use those networks to link to other a considerable threat to consumers, due to inadequate devices, such as computers, handheld appliances and mobile regulations regarding its security and use. phones. In many cases, the adoption of the technology is being driven Among the interviewees, there was a widespread belief that by businesses eager to gain valuable data from citizens, with many IoT devices would go unprotected because consumers little concern for their privacy or the protection of that data. do not know how to change the manufacturers’ default security settings. The drive to be the first to market has meant Over the next two years, the number of IoT devices entering that many manufacturers have not even considered the households is predicted to climb steeply from 9 devices per security implications of their devices. They have either not household currently, to 500 by 2022 according to the research built appropriate security measures, use inadequate measures house Gartner1, with IoT connectivity being bundled into or, in some cases, provide no settings at all to change. This products whether people want it or not. Some of the experts situation could create an even more frightening scenario than interviewed for this report such as Mikko Hypponen, chief the UK tabloid newspapers’ “phone hacking” scandal, due to a research officer for the cyber security company F-Secure, massive adoption of insecure IoT devices. which sponsored this report, said that in the future, devices without IoT capabilities may be more expensive because they'll lack data that can be harvested by manufacturers. Another significant concern highlighted by our research was "Personal data from the the problem of long, deliberately unwieldy and confusing connected home will terms and conditions associated with the use of devices that give the manufacturer the right to collect private data and often be bought and control of how its device is being used. sold, as the result of a Earlier this year the US manufacturer I-Robot’s CEO Colin lack of awareness among Angle suggested that the manufacturer may begin to sell the floor plans of houses which its robot vacuum cleaners had consumers about what the compiled to Amazon, Apple or Alphabet, parent company of Google. The three companies did not comment on I-Robot’s IoT is and what it does." suggestion. But I-Robot’s stock price soared from $35 to $102 when Angle suggested the possibility in a Reuters interview in June. Of even greater concern is the potential for IoT devices to be turned into eavesdropping mechanisms that can hear and see All of the analysts consulted pointed out that personal data what is going on wherever they have been deployed. Online from the connected home will often be bought and sold criminals could even access and control biometric data, such with consumers largely remaining oblivious to potential as fingerprints, voices and facial images stored as digital data. implications. Numerous cases have already emerged of webcams being According to all of those interviewed, this lack of awareness hacked on computers and mobile phones in order to spy will also result in significant security risks to individuals, since on their owners.2 Other IoT devices, such as smart meters, IoT devices with limited security will easily connect to home may reveal if people are in their homes by monitoring which WiFi networks and other radio protocols such as Bluetooth, appliances are being used and which rooms are being heated. 1 https://www.gartner.com/newsroom/id/2839717 2 https://null-byte.wonderhowto.com/how-to/hack-like-pro-secretly-hack-into-switch-on-watch-anyones-webcam-remotely-0142514 https://globalnews.ca/news/2158281/what-you-need-to-know-about-webcam-hacking-and-how-to-prevent-it https://us.norton.com/internetsecurity-malware-webcam-hacking.html https://www.geek.com/tech/mark-zuckerberg-tapes-up-his-webcam-and-snowden-says-you-should-too-1659083 https://www.theguardian.com/world/2016/jun/06/surveillance-camera-laptop-smartphone-cover-tape PINNING DOWN THE IOT 3 A recent example of this was the Mirai botnet which used IoT “The drive to be the first devices, such as web and CCTV cameras and routers, to carry out attacks on a number of internet-based businesses and to market has meant some internet service providers. that many manufacturers Many of those industry figures involved in the development have not even considered of the IoT interviewed for this report felt that the IoT industry is aware of the security issues surrounding the technology. the security implications Meanwhile there were resounding calls for regulation of the of their devices.” technology from all of the experts we consulted. For the purposes of this report, the authors interviewed politicians, a senior police officer, cyber security specialists, One other great danger from this explosion of poorly- industry analysts, think tank observers and industry figures protected connected objects is the potential for internet involved in developing technology for the IoT. instability. Already, hacking groups have proved themselves adept at using readily available analysis tools, such as Shodan, to discover flaws in particular devices and turn them into botnets. Hackers have already created their own search systems and exploited the freemium models of other IoT search systems. PINNING DOWN THE IOT 4 INTRODUCTION For the average consumer, the Internet of Things may be a “We would know when things needed replacing, repairing or new concept, but it has been with us for a number of years. recalling and whether they were fresh or past their best. The Internet of Things has the potential to change the world.” Used to connect everything from toasters in Japan, elephants in Kenya, sheep in Scotland, fridges in Korea, lamps in the US, Smartness and efficiency will become the catchphrases of the buildings in Germany and clothes and furniture in Scandinavia, age. Smart phones, smart watches, smart cities, smart houses the IoT is seen as the biggest trend in tech. The latest in chip- – even smart bras, pants, pills and tampons are the new chic. objects of desire. By using wireless networks, light waves, sound waves or hard- All of our devices will be talking to each other in a blizzard of wired connections we will be able to connect everything to data that will rapidly outpace us. According to the US telecoms the internet: computers; cars; mobile phones; food; fields; giant Cisco, by 2020 machine-generated data will exceed animals; roads; plants; planes; park benches; and people. the traffic generated by people as the sensors, servers and computers collect information from us and share it amongst We will be able to put sensors into everything, and those themselves.4 sensors will generate more and more data about us and our world. According to the computer multinational IBM, in 2016 we generated more data than we have in all the previous

Load more